@livx.cc/agentx 0.99.35 → 0.99.37

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AgentOptions, H as Hooks, i as RunResult, A as Agent } from './Agent-USp7SIao.js';
-export { C as ChatFragment, b as CompactResult, D as DEFAULT_MUTATING, c as Decision, P as PermissionOptions, d as PermissionPolicy, e as PermissionRule, f as PreToolUseDecision, R as ReasoningEffort, g as RecordingHooks, h as RecordingLifecycle, T as ToolUse, j as ToolUseMeta, k as composeHooks, l as estimateTokens, p as planMode, r as reasoningToChatFragment } from './Agent-USp7SIao.js';
+import { a as AgentOptions, H as Hooks, i as RunResult, A as Agent } from './Agent-B--fZNJy.js';
+export { C as ChatFragment, b as CompactResult, D as DEFAULT_MUTATING, c as Decision, P as PermissionOptions, d as PermissionPolicy, e as PermissionRule, f as PreToolUseDecision, R as ReasoningEffort, g as RecordingHooks, h as RecordingLifecycle, T as ToolUse, j as ToolUseMeta, k as composeHooks, l as estimateTokens, p as planMode, r as reasoningToChatFragment } from './Agent-B--fZNJy.js';
 export { MODEL_ALIASES, ModelSwitch, ResolveModelSwitchOpts, modelShortLabel, resolveModelAlias, resolveModelSwitch } from './models.js';
 import { IFilesystem, FileMetadata } from '@livx.cc/wcli/core';
 export { CommandExecutor, FileMetadata, IFilesystem, IndexedDbFilesystem, MemFilesystem, registerHeadlessCommands } from '@livx.cc/wcli/core';

package/dist/index.js

@@ -263,10 +263,10 @@ function stripContent(content, stub) {
 function endsOnAnnouncedAction(text) {
   const sentences = text.split(/(?<=[.!?])\s+|\n+/).map((s) => s.trim()).filter(Boolean);
   const last = sentences[sentences.length - 1];
-  if (!last || NEXT_STEP.test(last)) return false;
+  if (!last || NEXT_STEP.test(last) || SIGN_OFF.test(last)) return false;
   return ANNOUNCED_ACTION.test(last);
 }
-var log2, p_sep, IMAGE_ELIDE_STUB, IMAGE_REF_SCHEME, REF_REGISTRY_MAX, refRegistry, isImageRefUrl, bearsImage, ANNOUNCED_ACTION, NEXT_STEP;
+var log2, p_sep, IMAGE_ELIDE_STUB, IMAGE_REF_SCHEME, REF_REGISTRY_MAX, refRegistry, isImageRefUrl, bearsImage, ANNOUNCED_ACTION, NEXT_STEP, SIGN_OFF;
 var init_llm = __esm({
   "src/llm.ts"() {
     "use strict";
@@ -281,6 +281,7 @@ var init_llm = __esm({
     bearsImage = (m) => messageHasImage(m.content) || toolImageRef(m.content) != null;
     ANNOUNCED_ACTION = /^(?:also\s+|now\s+|then\s+)*(?:let me\b|i'?ll\b|i will\b|i'?m going to\b|(?:re-?)?(?:check|search|scan|read|verify|run|inspect|expand|look|examin|continu|proceed|try|fetch|load|open|test|build|grep|find|review|trac|dig|explor)\w*ing\b)/i;
     NEXT_STEP = /^next (?:step|run|up)\b/i;
+    SIGN_OFF = /^let me know\b/i;
   }
 });
 
@@ -3692,6 +3693,13 @@ var AgentOptions = class {
    *  permission-asking instead of answers (see the nudge text in runLoop).
    *  Fires at most once per run and only for delegated runtimes (native turns never emit the trigger). */
   closeDelegatedTurns = true;
+  /** Catch a FABRICATED tool use: a turn that emits no tool call at all, yet whose text names an advertised
+   *  tool this run has never actually invoked — the model announcing `look_at_app` and then writing its own
+   *  "it didn't respond in time" result. No call-reactive layer can see it (there IS no call), and to every
+   *  surface it is indistinguishable from a real failure. The discriminator is the per-run invocation ledger,
+   *  not prose: a named tool with zero invocations is provable. On detection the loop nudges ONCE for a real
+   *  call, and records the names in `RunResult.fabricatedToolClaims` either way. */
+  catchFabricatedToolUse = true;
   /** Fold the dropped middle of an over-long transcript into a synthetic summary (edge-safe, no LLM). Off => drop-oldest. */
   compaction;
   /** Add `Checkpoint`/`Rollback` tools (requires the fs to be an OverlayFilesystem). */
@@ -3758,6 +3766,11 @@ var Agent = class _Agent {
   lastTrimNotified = 0;
   // last auto-trim drop count surfaced via host.notify (dedup)
   activeTools = [];
+  /** Per-run ground truth: every tool name actually INVOKED this run (native dispatch + delegated
+   *  runtime activity). The ledger that makes a fabricated tool claim provable. Reset per run. */
+  invokedTools = /* @__PURE__ */ new Set();
+  /** Advertised tools this run's text claimed to have used while the ledger showed zero calls. */
+  fabricatedClaims = /* @__PURE__ */ new Set();
   activeHooks;
   // composed: user hooks + plan-mode + permissions
   prepared = false;
@@ -3949,6 +3962,8 @@ var Agent = class _Agent {
     await this.ensureFs();
     this.prepared = false;
     this.started = false;
+    this.invokedTools.clear();
+    this.fabricatedClaims.clear();
     const systemPrompt = await this.prepare(contentText(task));
     const startCtx = await this.fireSessionStart();
     const userContent = await this.applyPromptSubmit(task);
@@ -4049,7 +4064,7 @@ var Agent = class _Agent {
     const kill = (finishReason) => {
       log6.warn(`kill-switch: ${finishReason} (steps=${steps}, tokens=${usage.totalTokens}, budgetTokens=${Math.round(usage.totalTokens - 0.9 * usage.cacheReadTokens)}, ms=${Date.now() - start - this.parkedMs}${finishReason === "timeout" ? `, idle=${Date.now() - lastProgressAt - this.parkedMs}ms` : ""}${this.parkedMs ? ` +${this.parkedMs} parked` : ""})`);
       this.ctx.jobs?.killAll();
-      return { text: lastAssistantText(this.transcript), steps, finishReason, messages: this.transcript, usage, usageEstimated };
+      return { text: lastAssistantText(this.transcript), steps, finishReason, messages: this.transcript, usage, usageEstimated, ...this.fabricatedClaims.size ? { fabricatedToolClaims: [...this.fabricatedClaims] } : {} };
     };
     while (true) {
       if (o.signal?.aborted) return kill("aborted");
@@ -4188,6 +4203,17 @@ var Agent = class _Agent {
       }
       if (toolCalls.length === 0) {
         if (this.drainInjections()) continue;
+        const fabricated = o.catchFabricatedToolUse && !closureNudged ? this.fabricatedToolNames(contentText(res.content ?? "")) : [];
+        for (const n of fabricated) this.fabricatedClaims.add(n);
+        if (fabricated.length && steps < o.maxSteps) {
+          closureNudged = true;
+          log6.warn(`fabricated tool use: text names ${fabricated.join(", ")} but the run invoked ${this.invokedTools.size ? [...this.invokedTools].join(", ") : "nothing"} \u2014 demanding the real call`);
+          this.transcript.push({
+            role: "user",
+            content: `You referred to ${fabricated.map((n) => `\`${n}\``).join(", ")} in your reply, but you never actually called ${fabricated.length > 1 ? "those tools" : "that tool"} \u2014 no tool call was made, so any result you reported for ${fabricated.length > 1 ? "them" : "it"} was invented. Either call ${fabricated.length > 1 ? "them" : "it"} for real now, or answer without ${fabricated.length > 1 ? "them" : "it"} and do NOT claim any outcome \u2014 including a failure or a timeout \u2014 for a call you did not make.`
+          });
+          continue;
+        }
         if (o.closeDelegatedTurns && res.endedWithoutClosing && !closureNudged && steps < o.maxSteps) {
           closureNudged = true;
           log6.verbose("delegated turn went silent after a tool \u2014 nudging a closing answer");
@@ -4201,7 +4227,7 @@ var Agent = class _Agent {
         await this.ctx.jobs?.drain();
         this.releaseStaleImages();
         await this.activeHooks?.onStop?.(res.content ?? "");
-        return { text: res.content ?? "", steps, finishReason: "stop", messages: this.transcript, usage, usageEstimated };
+        return { text: res.content ?? "", steps, finishReason: "stop", messages: this.transcript, usage, usageEstimated, ...this.fabricatedClaims.size ? { fabricatedToolClaims: [...this.fabricatedClaims] } : {} };
       }
       const fp = toolCalls.map((tc) => tc.function.name + ":" + (tc.function.arguments ?? "")).join("|");
       repeats = fp === lastFp ? repeats + 1 : 1;
@@ -4317,6 +4343,7 @@ var Agent = class _Agent {
           prev.status = a.status;
         }
         sawTool = true;
+        this.invokedTools.add(a.name);
         trailing = "";
       }
       if (chunk.content) {
@@ -4332,7 +4359,51 @@ var Agent = class _Agent {
     const endedWithoutClosing = sawTool && (!trailing.trim() || endsOnAnnouncedAction(trailing));
     return { content, ...finishReason ? { finishReason } : {}, ...toolCalls ? { toolCalls } : {}, ...usage ? { usage } : {}, ...delegatedTools.length ? { delegatedTools } : {}, ...endedWithoutClosing ? { endedWithoutClosing: true } : {} };
   }
+  /**
+   * FABRICATED TOOL USE — the failure no call-reactive layer can see, because there IS no call.
+   *
+   * The model announces a tool ("I'll take a look with look_at_app"), emits no tool_use block at all, and
+   * then writes a plausible RESULT for the call it never made ("the app view didn't respond in time"). To
+   * every surface that turn is indistinguishable from a genuine timeout: the user reads a credible failure
+   * sentence, the logs show no tool call because none was made, and nothing errors. Malformed-call handling
+   * (dispatch's earlyError) cannot reach it — that path needs a tool_use block to exist.
+   *
+   * The discriminator is NOT prose. It is the per-run invocation ledger, which is ground truth: an advertised
+   * tool NAMED in the model's own text while `invokedTools` holds zero calls to it is a provable claim about
+   * an event that did not happen, not a guess about phrasing. Matching is on the exact registered tool name
+   * at word boundaries, so it cannot fire on ordinary English the way `endsOnAnnouncedAction` can.
+   *
+   * Deliberately narrow, because a false positive costs a metered step:
+   *  - only tools with a distinctive name (>= 4 chars, containing `_`, `-` or a capital) — a tool named `run`
+   *    or `web` would match half of English prose;
+   *  - only against the ledger for the WHOLE run, so referring back to a call it genuinely made earlier
+   *    ("the screenshot showed an empty grid") is honest and stays silent;
+   *  - only on a turn that made no tool calls of its own — a turn that DID call tools is closing normally.
+   *    (That is the enclosing `toolCalls.length === 0` branch. It is NOT extended to delegated activity:
+   *    a `cursor/*` turn runs its own tools and then fabricates in the SAME response, which is the exact
+   *    reported defect — see the call site.)
+   *
+   * What it deliberately does NOT catch, both verified:
+   *  - a fabrication that names no tool at all ("Let me take a look at the running app. The app view did
+   *    not respond in time.") — there is nothing to prove it against. Only prose matching could reach it,
+   *    and ungating `endsOnAnnouncedAction` for that was tried and reverted (it fires on ordinary English).
+   *  - a SECOND invented result for a tool the run genuinely called earlier. The ledger is per-run by
+   *    design, because that is the same fact that keeps an honest back-reference ("the screenshot showed
+   *    an empty grid") silent. Distinguishing them would need per-claim positional accounting, which buys
+   *    a rarer case at the cost of the common honest one.
+   */
+  fabricatedToolNames(text) {
+    const out = [];
+    for (const t of this.activeTools) {
+      if (this.invokedTools.has(t.name)) continue;
+      if (t.name.length < 4 || !/[_\-A-Z]/.test(t.name)) continue;
+      const re = new RegExp(`(?:^|[^\\w])${t.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^\\w]|$)`);
+      if (re.test(text)) out.push(t.name);
+    }
+    return out;
+  }
   async dispatch(tc) {
+    this.invokedTools.add(tc.function.name);
     const tool = this.activeTools.find((t) => t.name === tc.function.name);
     let args = {};
     let earlyError;